Apache MINA SSHD patches seven flaws, two critical LDAP bypasses

Apache MINA SSHD 2.20.0 and 3.0.0-M6 fix seven flaws, including two critical unauthenticated LDAP authentication bypasses.

On 29 September 2026, oss-security posts disclosed seven Apache MINA SSHD vulnerabilities, all addressed in 2.20.0 and 3.0.0-M6. The most severe are CVE-2026-94052, a missing check in LdapPasswordAuthenticator, and CVE-2026-94053, LDAP injection in the optional sshd-ldap component; both are unauthenticated, rated critical, and scored CVSS 3.1 9.1 with high confidentiality and integrity impact, on 1.2.0 through 2.19.0 and milestones 3.0.0-M1 through 3.0.0-M5. CVE-2026-93994, rated important at CVSS 3.1 8.1, lets a low-privileged user bypass a repeated-publickey multi-authentication requirement on builds before 2.20.0 and those same milestones. Memory exhaustion is covered by CVE-2026-93996 in sshd-scp (CVSS 6.5, moderate), CVE-2026-94029 in SFTP v6 check-file extensions (CVSS 6.5, versions 1.0.0 to 2.19.0), and client-side CVE-2026-94002 via unsolicited replies to DefaultSftpClient (CVSS 7.5, no privileges, versions 0.9.0 through 2.19.0). CVE-2026-93995, CVSS 3.1 6.5, lets an authenticated user write a server file through JGit archive handling in sshd-git. Notices that discuss exploitation do not report in-the-wild use; sources agree on scores and fixed releases, while affected-range wording varies between before 2.20.0 and through 2.19.0.

• On 2026-09-29, oss-security disclosed seven Apache MINA SSHD flaws, all fixed in 2.20.0 and 3.0.0-M6.
• CVE-2026-94052 is a critical missing authentication check in LdapPasswordAuthenticator (sshd-ldap), CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N), with high confidentiality and integrity impact; affected are 1.2.0 before 2.20.0 and 3.0.0-M1 before…
• CVE-2026-94053 is critical unauthenticated LDAP injection in optional sshd-ldap that can bypass authentication, CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); affected are 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5; Thomas…
• CVE-2026-93994 bypasses a repeated-publickey multi-authentication server policy, rated important, CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); builds before 2.20.0 and milestones 3.0.0-M1 through 3.0.0-M5 are affected, and…
• CVE-2026-93995 is improper input validation in sshd-git: an authenticated user can write a server file via JGit archive -o=file.zip handling, CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N); versions up to 2.19.0 and 3.0.0-M1 through…
• CVE-2026-93996 is moderate memory exhaustion in sshd-scp from an unbounded SCP command-line read, CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), through 2.19.0 and 3.0.0-M1 through 3.0.0-M5.